netdev - Re: [PATCH next v3] bonding: Display LACP info only to CAP_NET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150619170730.GR588@gospo.home.greyhouse.net>
Date:	Fri, 19 Jun 2015 13:07:31 -0400
From:	Andy Gospodarek <gospo@...ulusnetworks.com>
To:	Mahesh Bandewar <maheshb@...gle.com>
Cc:	Jay Vosburgh <j.vosburgh@...il.com>,
	Andy Gospodarek <andy@...yhouse.net>,
	Veaceslav Falico <vfalico@...il.com>,
	Nikolay Aleksandrov <nikolay@...hat.com>,
	David Miller <davem@...emloft.net>,
	netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH next v3] bonding: Display LACP info only to CAP_NET_ADMIN
 capable user

On Fri, Jun 19, 2015 at 10:02:39AM -0700, Mahesh Bandewar wrote:
> On Thu, Jun 18, 2015 at 8:00 PM, Andy Gospodarek
> <gospo@...ulusnetworks.com> wrote:
[...]
> > With this patch, actor_oper_port_state and partner_oper.port_state are
> > not displayed in /proc, but that information is available via netlink
> > from bond_fill_slave_info().
> >
> > I suspect you do not deem these two values as critical to the security
> > of the system, but wanted to confirm before ACKing.
> >
> Yes, one can very easily figure out that LACP is used in the system
> with parameters like bond-mode, lacp-rate, or the port-state. I feel
> these do not need to be hidden from unprivileged users to ensure
> security. Principally hiding enough to ensure security would be good
> rather than hiding everything. However if there is a scenario where
> exposing these values is a threat (in the same sense) then it's not
> lot of extra work to achieve that and I'm open to make those change.

Sounds fine to me.  I just wanted to be sure the diffrence between the
information displayed in various modes was intentional (or at least not
unintentional) and did not conflict with your plans.

Signed-off-by: Andy Gospodarek <gospo@...ulusnetworks.com>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in